Research activity in 2001
The group's work in Security and Computer Network started in 1994, with special interest in public key systems as a basis for applications in secure wide area network communications. Since then, ten students have graduated with a thesis in network security, supervised by Prof. Bergadano. This activities continued until the present day, with significant collaboration with the University of Cambridge. This collaboration has included research on such issues as public key certification, innovative digital signature mechanisms, and WWW security. From 1994 until 1996, research activities in the area of secure agent architectures were investigated, in collaboration with Prof. Vita, at the University of Messina. In1996, activities in computer security were also started, especially in the areas of password checking,intrusion detection and Web Security. Other undergraduate theses are under completion in this area, also supervised by Prof. Bergadano. On the other hand, in the wider area of computer networks, Prof. Sirovich has investigated the ISO/OSI protocols during the past ten years, with special reference to network management and directory services. The activity in 2001 has included a project for the study and the implementation of secure multicast transmission and video-conferencing; the development of a system to certify the number of visitors of an Internet site; the study of biometric systems to recognize users and reject impostors and to track legal users over remote connections.
a) Secure WWW
In the context of web traffic, it is important that the interaction betweenclient and server is secure.In particular the server should be always in a position such that it canprovide its services.Within the Internet scenario two requirements must be satisfied: the possibility toidentify and locate (geographically) the clients connecting to the serverto avoid IP spoofing, and the production of reports related to the serveractivity. In particular reports should be meaningful to humans.Both these necessities need effective solutions that are compatible withthe protocols and softwares used to transmit data on the Web.The research in this field proposed solutions to the discussed problems.
b) Multicast Conferencing and Security
Multicast transmission is an efficient way of sending data from one transmitterto a set of receivers. At the same time the authentication of origin of suchdata poses novel problems, solved developing novel protocols and implementingone of them in an audio tool (in the previous year).Studies, analysis and tests were performed on the functionality of the developed tool, andon the correctness of the proposed protocols, taking into account theinternational literature.Some tests were performed on the configuration of routers for multicasttransmission to gain experience in this field.One event used to test the configuration was the transmission onthe MBone network (a network layered on theInternet, to have multicast transmission) of the Web Technology Forum 2001.
c) Large file signature
Strictly connected with the previous research, some study was performed on thesignature and certification of large amount of data (like a video stream, ora log file), when the signer cannot examine the whole data, for example for efficiency of the signature, or for privacy reasons.
d) Internet Traffic Certification
It is important to know who, when, how many times and how users visited a web site. This information must be precise and certain (i.e., it must reflect the effective activity of people navigating within a site and from one site to another). During 2000 and 2001 a system able to gather and certify such information for the web site on which it is installed has been developed and extensively tested.
e) The X.500 protocol Directory (Franco Sirovich)
The X.500 protocol directory allows to realize a sophisticated distributed database with a partial reproduction of the database. Substantially, it is a free scheme with research functions for the database content. In the 1992 standard from ISO and CCITT, the functionality of the X.500 service was extended introducing access control. Basic Access Control functionalities have been studied, and an algorithm was developed to verify at runtime the access control for a generic X.500 database. A new interesting concept has originated from the research and development on Directories: The Concept of MetaDirectory. A MetaDirectory is a controlled union of all the Directories of an Organisation, that on one side allows to have a single point of access to a common repository of data for the whole organisation, and on the other side allows to synchronise and the data contained in different data bases and to control the flow of data from one data base to another that is configured to receive the updates of the data from the "master" one. The interesting point is that the master ship is defined at the attribute level, and the values of attributes can be obtained via an appropriate computation from one or moresource attributes. We are experimenting with these new concepts in the area of controlled access to University data from web servers.
f) Network Management (Franco Sirovich)
With the development of applications on computer networks, the problem of managing complex network systems became more and more important. Both within ISO/ITU and Internet, specific protocols and informative models have been developed to realize a distributed system to handle both network elements and distributed network applications. The two network management models are not equivalent, even if a comparative study of them points out interesting analogies. Cryptographic key management in a security system for telecommunications is an interesting area to apply the management model and the corresponding OSI protocols.
An interesting problem the is now being studied is the monitoring of Service Level Agreements. With the widespread adoption of outsourcing contract for the ITC services, the need has emerged of defining precisely the LEvel of Service that the provider must offer to the Users. The finalisation of document called Service Level Agreement is considered to be extremely beneficial to the achievement of customer satisfaction. The problem is now that of being able to monitor level of service that is being offered to group of Users and to be able to manage the resources of the ITC system so that the level of service defined in the SLA is actually met, thus avoiding that the users perceive a degradation of service.
MOnitoring Service LEvel Agreements is radically different than monitoring the performance of devices, computers, or telecommunication lines, because requires the measure of the service that is being delivered the actual users by applications, and not the service that the application "believes" is delivering to users. A Service Level Agreement Monitoring system must be able to allow the operators to identify the real causes of performance degradation, before the users perceive such a degradation and complain with the administrators.
g) Public key systems and certification
This research is concerned with public key certification in distributed environments, proposing a certification scheme to exchange documents that are digitally signed. Our system, proposed in collaboration with the University of Cambridge, includes the implementation of a separate authority dedicated to delete the public key certificates that are no longer valid. Log file records are bound in a chain of hash values, so that they may not be deleted by the authority in an undetected way. The system has been implemented and a series of experiments is starting to integrate the above certification system with a few browser and mail services available on the market, both in Unix and Windows NT environments. Through this structure is possible to obtain a number of secure services that require signed and/or encrypted documents to be sent.
g.1) Secure Mailtools
In this research we studied PGP (Pretty Good Privacy), the most popular mail encryption and signature tool available worldwide. Within the context of two undergraduate theses, that were supervised by the security group, a public domain program, named "ACT", was implemented in 1997 and maintained in 1998, 1999, 2000 and 2001. This tool is compatible with PGP (versions prior to 5.0), but solves some of its weaknesses.
g.2) Digital Signatures and Authentication
The research was about the study of the mechanism to generate digital signatures based on public key algorithms. In collaboration with the University of Cambridge we made a new and alternative proposal to generate digital signatures based only on hash function chains. This mechanism turns out to be more efficient than the traditional approaches, and moreover it does not involve all the problems connected to the restrictions imposed by some countries about the export of encryption software.
